# Attackers use flash loans to seize two of three seats on X100's Senate and drain up to $4.85 million on Ethereum

The governance contract read live staked balances and carried out decisions instantly, and the attacker has since moved 821.2 ether into Tornado Cash. A separate signature-replay attack and several older incidents complete the month's ledger.

- Published: 2026-10-27T05:37:50.880Z
- Canonical: https://polylog.news/crypto/2026-10-27/attackers-use-flash-loans-to-seize-two-of-three-seats-on-x10
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/56adc62f45a4774c4d584014b3e5284b0f4d5742), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/708f450b16c858cfeb8230a6902331ede4867216), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/7194cf3605235e8fb4d5ecced7a83a38c2eea4a6), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/cabaee7c9a3651f04da23e6b570c18881af0ee82), [Rekt News](https://www.rekt.news/)

**X100 (Ethereum, $4.75 million to $4.85 million, governance attack).** On October 24, an attacker took control of X100 Global's three-seat Senate and emptied the project's treasury. DeFiHackLabs has added a [proof-of-concept reconstruction](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/56adc62f45a4774c4d584014b3e5284b0f4d5742) of the attack. According to [reporting on the exploit](https://cryptoadventure.com/x100-loses-4-85-million-as-flash-loan-attack-hijacks-governance/), the attacker took out a flash loan, bought X tokens, and split them between two newly deployed contracts. Each contract staked slightly more than 19,000 X in X100's "Freezer" system. That pushed out existing Senate members and gave the attacker two of three seats. With that majority, the attacker forced the treasury to sell assets into a pool the attacker controlled. The root cause was design, not a coding mistake. Governance had no voting snapshot, no minimum stake age and no delay between approval and execution. The proceeds were converted to ether (ETH) and split across four wallets. The labeled exploiter address then [deposited 821.2 ETH into Tornado Cash](https://www.cryptotimes.io/2026/10/26/x100-exploiter-moves-821-eth-into-tornado-cash-after-4-75m-exploit/). No recovery or attribution has been reported.

**Argent-style smart wallet (Ethereum, about $59,800, signature replay).** On October 19, an attacker drained wallets built on an Argent-derived design in two transactions that lasted about one minute. DeFiHackLabs has [published a reconstruction](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/708f450b16c858cfeb8230a6902331ede4867216), [revised it](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/7194cf3605235e8fb4d5ecced7a83a38c2eea4a6) and [merged it](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/cabaee7c9a3651f04da23e6b570c18881af0ee82). An [analysis of the incident](https://dev.to/pandasecurity/argent-style-wallet-exploit-recovery-wrap-and-replay-57p8) found two flaws. The relayed-signature path checked the owner or guardian signature but never used up a nonce. The deadline check also overflowed, so years-old signatures still passed. The attacker replayed the same signed bytes 19 times and then 9 times. That made the victim wallets buy MARK repeatedly in a thin Uniswap V2 pool, while the attacker traded against those purchases to profit from the price moves. SlowMist put the loss at about $59,800. Public reports say the deployment was not the official Argent wallet.

**Older incidents with updates.** [Rekt News](https://www.rekt.news/) has been revisiting several recent cases. NEAR Intents lost [$3.87 million from a BNB Chain vault](https://finance.yahoo.com/markets/crypto/articles/near-intents-says-exploited-3-094252429.html) over September 30 and October 1. An attacker used an interaction between the Omni bridge's deposit and withdrawal paths and the intents contract to create unbacked balances, then withdrew them as real USDT. The team named the wallet publicly, and the attacker returned all of the funds. The crypto casino Duelbits lost [about $7 million from its hot wallets](https://www.coindesk.com/business/2026/09/24/crypto-casino-duelbits-goes-offline-after-usd7m-hot-wallet-hack) on September 24 in a suspected private-key compromise. As of October 19, most of the money had not been recovered, no attacker had been named, and Duelbits had offered an on-chain bounty. Balancer token holders [voted 99.2% to wind down the protocol](https://rekt.news/out-of-balance) 11 months after a $128 million exploit, which came from a rounding error in a v2 scaling function. Rekt reports that the pools move to withdrawals-only on October 30 and that redemptions are expected to open in May 2027 at about $0.158 per BAL.

## What this means

X100's contracts did exactly what they were written to do. The flaw was that a governance majority could be rented for the length of one transaction. Small treasuries are the most exposed. Their governance tokens trade in pools shallow enough to buy a majority with a flash loan, and their teams copy council-style designs without snapshots or timelocks. The precedent is Beanstalk in April 2022, where a flash-loaned vote drained about $182 million. Afterward, most large protocols adopted snapshot voting and execution delays. The long tail of protocols did not, and X100 shows that the gap is still there. The Balancer wind-down shows the slower cost of exploits. Remaining holders get a fraction of book value and wait more than a year to collect it. The likelier outcome over the coming months is more same-block governance captures against small treasuries, because the attack can be reused and the defenses are documented but optional. The read would be wrong if audit firms began requiring timelock and snapshot checks as standard scope and the next quarter's loss data showed governance attacks declining.

## What to watch

- Whether the X100 exploiter moves more of the four 400-ETH wallets into mixers, or whether an exchange freezes any of it. Either tells us whether these funds can still be recovered.
- Whether other projects that forked the Argent wallet design publish nonce and deadline fixes. Copied code tends to carry the same replay flaw into every deployment.
- How many Balancer pool holders actually withdraw before and after the October 30 cutoff. That shows how much value a wound-down protocol returns in practice.